Creating Firewall Policy Intents

Description

Enter a description for the policy intent; maximum length is 1024 characters. Comments entered in this field are sent to the device.

Source

Click on the add icon (+) to select the source endpoints on which the firewall policy intent applies, from the displayed list of addresses, departments, sites, site groups, users, or the Internet. You can also select a source endpoint using the methods described in Selecting Firewall Source.

Select Action

Click the add icon (+) to choose whether you want to permit, deny, or reject traffic between the source and destination.

• Allow—Device permits traffic using the type of firewall authentication you applied to the policy.

• Deny—Device silently drops all packets for the session and does not send any active control messages such as TCP Resets or ICMP unreachable.

• Reject—Device sends a TCP reset if the protocol is TCP, and device sends an ICMP reset if the protocols are UDP, ICMP, or any other IP protocol. This option is useful when dealing with trusted resources so that applications do not waste time waiting for timeouts and instead get the active message.

Scheduling

Policy schedules enable you to define when a policy is active, and thus are an implicit match criterion. You can define the day of the week and the time of the day when the policy is active. For instance, you can define a security policy that opens or closes access based on business hours. Select a pre-saved schedule and the schedule options are populated with the selected schedule’s data.

Procedure

1. Click on Scheduling, to enable scheduling.
2. Click the add icon (+), to add an existing schedule. If you want to view more results in the End Points pane, click View more results.

   Alternately, you can add a schedule from the End Points panel, by selecting the schedule and clicking on the check mark icon (√).

3. The selected schedule is added to the firewall policy.

You can also create new schedules and then associate the schedule to your firewall policy.

Procedure

1. Click on Scheduling, to enable scheduling.
2. Click the add icon (+), and then click Add new schedule.

   The Create Schedules page appears.

3. Alternately, click the lesser-than icon (<) to open the End Points panel. Click on the add icon (+) on the top right of the panel and select Schedule.

   The Create Schedules page appears.

4. Create a new schedule. See Creating Schedules.

   The new schedule appears in the list of schedules when you click on Scheduling and in the End Points tab, under Schedules.

5. Select the schedule and click on the add icon (+) to add it to the firewall policy.

UTM

Enable the UTM option for protection against multiple threat types including spam and malware, and control access to unapproved websites and content. Click Select UTM profile to select a UTM profile from the list of UTM profiles displayed.

• Click on View more results to see more UTM profile in the Endpoints panel on the right.

• Click Add new profile to create a new UTM profile. See Creating UTM Profiles for more information on creating a new UTM profile.

End Points

Procedure

1. Click on Source or Destination and then click the lesser-than icon on the right side of the page to open the End Points panel.

   The End Points panel displayed the end points relevant to the source or destination based on your selection.

   • End points from addresses, departments, users, and sites are displayed for source.

     Note: If JIMS is not configured for CSO, users will not be listed in the Endpoints panel. Instead you will be provided with an option to import users through the Administration > Identity Management page. To import users, click Set Up and follow the steps provided in About the Identity Management Page.

   • End points from addresses, applications, departments, services, and sites are displayed for destination.

   Note: You can also search for a specific end point using the search option.

2. (Optional) Click on the edit icon (pencil symbol) to modify an end point.
3. (Optional) Click on the details icon on the right of the endpoint, to view more information about a source or destination endpoint.
4. Select the end point you want to add and click on the check mark icon (√) to add it the source or destination.

   The selected end point is added to the source or destination.

Procedure

1. Click the less-than icon (<) on the right side of the page, to open the End Points panel.

2. Click on the add icon (+) on the top right of the End Points panel.

   A list of end points that you can create is displayed.

3. Select the end point you want to create.

   You can create the following end points:

   • Create an address. See Creating Addresses or Address Groups.

   • Create a site group. See Creating Site Groups.

   • Create a department. See Adding a Department.

   • Create a service. See Creating Services and Service Groups.

   • Create an application signature group. See Creating Application Signature Groups.

   • Create a schedule. See Creating Schedules.

4. Click Save to create the new end point.

   The created end point is listed in the End Points panel.

5. Select the end point you want to add to the source or destination, and click on the check mark icon (√).

   The end point is added to the source or destination.